Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2007-0957

Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.

Published

2007-04-06T01:19:00.000

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 9.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

8.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mit	kerberos_5	< 1.6.1	Yes
Operating System	debian	debian_linux	3.1	Yes
Operating System	debian	debian_linux	4.0	Yes
Operating System	canonical	ubuntu_linux	5.10	Yes
Operating System	canonical	ubuntu_linux	6.06	Yes
Operating System	canonical	ubuntu_linux	6.10	Yes

References

ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc Broken Link ([email protected])
http://docs.info.apple.com/article.html?artnum=305391 Broken Link ([email protected])
http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html Mailing List, Third Party Advisory ([email protected])
http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html Broken Link ([email protected])
http://secunia.com/advisories/24706 Third Party Advisory ([email protected])
http://secunia.com/advisories/24735 Third Party Advisory ([email protected])
http://secunia.com/advisories/24736 Third Party Advisory ([email protected])
http://secunia.com/advisories/24740 Third Party Advisory ([email protected])
http://secunia.com/advisories/24750 Third Party Advisory ([email protected])
http://secunia.com/advisories/24757 Third Party Advisory ([email protected])
http://secunia.com/advisories/24785 Third Party Advisory ([email protected])
http://secunia.com/advisories/24786 Third Party Advisory ([email protected])
http://secunia.com/advisories/24798 Third Party Advisory ([email protected])
http://secunia.com/advisories/24817 Third Party Advisory ([email protected])
http://secunia.com/advisories/24966 Third Party Advisory ([email protected])
http://secunia.com/advisories/25464 Third Party Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-200704-02.xml Third Party Advisory ([email protected])
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102930-1 Broken Link ([email protected])
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt Patch, Vendor Advisory ([email protected])
http://www.debian.org/security/2007/dsa-1276 Third Party Advisory ([email protected])
http://www.kb.cert.org/vuls/id/704024 Third Party Advisory, US Government Resource ([email protected])
http://www.mandriva.com/security/advisories?name=MDKSA-2007:077 Third Party Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2007-0095.html Third Party Advisory ([email protected])
http://www.securityfocus.com/archive/1/464592/100/0/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/archive/1/464666/100/0/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/archive/1/464814/30/7170/threaded Third Party Advisory, VDB Entry ([email protected])
http://www.securityfocus.com/bid/23285 Third Party Advisory, VDB Entry ([email protected])
http://www.securitytracker.com/id?1017849 Third Party Advisory, VDB Entry ([email protected])
http://www.ubuntu.com/usn/usn-449-1 Third Party Advisory ([email protected])
http://www.us-cert.gov/cas/techalerts/TA07-093B.html Third Party Advisory, US Government Resource ([email protected])
http://www.us-cert.gov/cas/techalerts/TA07-109A.html Third Party Advisory, US Government Resource ([email protected])
http://www.vupen.com/english/advisories/2007/1218 Third Party Advisory ([email protected])
http://www.vupen.com/english/advisories/2007/1250 Third Party Advisory ([email protected])
http://www.vupen.com/english/advisories/2007/1470 Third Party Advisory ([email protected])
http://www.vupen.com/english/advisories/2007/1983 Third Party Advisory ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/33411 Third Party Advisory, VDB Entry ([email protected])
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10757 Broken Link, Third Party Advisory ([email protected])
ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://docs.info.apple.com/article.html?artnum=305391 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24706 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24735 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24736 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24740 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24750 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24757 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24785 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24786 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24798 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24817 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/24966 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/25464 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-200704-02.xml Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102930-1 Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2007/dsa-1276 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.kb.cert.org/vuls/id/704024 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDKSA-2007:077 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2007-0095.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/464592/100/0/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/464666/100/0/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/archive/1/464814/30/7170/threaded Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securityfocus.com/bid/23285 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1017849 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/usn-449-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA07-093B.html Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.us-cert.gov/cas/techalerts/TA07-109A.html Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/1218 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/1250 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/1470 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.vupen.com/english/advisories/2007/1983 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/33411 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10757 Broken Link, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)